release: adopt main 44a0cd6 onto runtime-production (candidate runtime SHA)

.github/CODEOWNERS

@@ -1 +1,4 @@
-* @Pigbibi
+# Blanket personal review assignment is intentionally disabled.
+# Do not automatically request a personal review for every pull request:
+# withdrawing a request after creation cannot prevent its notification.
+# Required CI and investment/runtime authorization remain independently enforced.

.github/workflows/diagnose-account-facts-receiver.yml

@@ -0,0 +1,48 @@
+name: Diagnose Binance Account Facts Receiver
+
+"on":
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: binance-account-facts-readonly
+  cancel-in-progress: false
+
+jobs:
+  readiness:
+    if: github.event_name == 'workflow_dispatch' && github.repository == 'QuantStrategyLab/BinancePlatform' && github.ref == 'refs/heads/main'
+    runs-on: self-hosted
+    timeout-minutes: 2
+    environment: binance-runtime
+    steps:
+      - name: Checkout the exact dispatch revision
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Require the exact current main revision
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ "$GITHUB_EVENT_NAME" != "workflow_dispatch" || \
+            "$GITHUB_REPOSITORY" != "QuantStrategyLab/BinancePlatform" || \
+            "$GITHUB_REF" != "refs/heads/main" || \
+            ! "$GITHUB_SHA" =~ ^[0-9a-f]{40}$ || \
+            "$(git rev-parse HEAD)" != "$GITHUB_SHA" ]]; then
+            echo "receiver_diagnosis_source_unqualified" >&2
+            exit 1
+          fi
+          current_main_sha="$(git ls-remote https://github.com/QuantStrategyLab/BinancePlatform.git refs/heads/main 2>/dev/null | awk 'NF == 2 && $2 == "refs/heads/main" { print $1 }')"
+          if [[ ! "$current_main_sha" =~ ^[0-9a-f]{40}$ || "$current_main_sha" != "$GITHUB_SHA" ]]; then
+            echo "receiver_diagnosis_main_sha_mismatch" >&2
+            exit 1
+          fi
+
+      - name: Read receiver readiness once
+        shell: bash
+        env:
+          BINANCE_ACCOUNT_FACTS_SYNC_TOKEN: ${{ secrets.BINANCE_ACCOUNT_FACTS_SYNC_TOKEN }}
+        run: python3 scripts/diagnose_binance_account_facts_receiver.py

.github/workflows/main.yml

@@ -221,7 +221,7 @@ jobs:
 
       - name: Publish disabled host observation
         if: ${{ steps.disabled-host.outputs.publish_ready == 'true' }}
-        uses: QuantStrategyLab/QuantRuntimeSettings/actions/publish-runtime-target-lifecycle@bbacba04baccbca91e4ba59c4dcaf460847e29f7
+        uses: QuantStrategyLab/QuantRuntimeSettings/actions/publish-runtime-target-lifecycle@f2597e8bfb25881242b13145cb5f42d06ba3476c
         with:
           source-id: binance.runtime-target-lifecycle
           target-id: ${{ steps.disabled-host.outputs.target_id }}

.github/workflows/notify-bot-identity.yml

@@ -0,0 +1,50 @@
+name: Notify Bot Identity (read-only)
+
+# Resolves the Telegram token the Binance runtime would use (main.yml deploy job:
+# secrets.TG_TOKEN, a repo-level secret; binance-runtime only holds other secrets
+# and is restricted to runtime-production, so this job does not bind it) to its public bot id/username via
+# getMe, and compares it with the unified QSL资产管家 bot (8334367951).
+# Prints only bot id / username; never prints token or chat id; sends no message;
+# does not re-enable main.yml or change any secret.
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  identity:
+    name: TG_TOKEN bot identity (read-only)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      TG_TOKEN: ${{ secrets.TG_TOKEN }}
+      TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
+      EXPECTED_BOT_ID: "8334367951"
+    steps:
+      - name: Resolve bot identity
+        run: |
+          python3 - <<'PY'
+          import json, os, urllib.request
+          expected = int(os.environ["EXPECTED_BOT_ID"])
+          out = []
+          for key in ("TG_TOKEN", "TELEGRAM_TOKEN"):
+              token = (os.environ.get(key) or "").strip()
+              if not token:
+                  out.append({"env": key, "status": "absent"})
+                  continue
+              try:
+                  with urllib.request.urlopen(f"https://api.telegram.org/bot{token}/getMe", timeout=15) as r:
+                      body = json.loads(r.read().decode("utf-8"))
+                  res = body.get("result") or {}
+                  out.append({"env": key, "status": "ok" if body.get("ok") else "getme_not_ok",
+                              "bot_id": res.get("id"), "bot_username": res.get("username"),
+                              "same_bot_as_unified": res.get("id") == expected})
+              except Exception as exc:  # noqa: BLE001
+                  out.append({"env": key, "status": f"getme_failed:{type(exc).__name__}"})
+          text = json.dumps({"runtime_token_env": "TG_TOKEN", "expected_bot_id": expected, "tokens": out},
+                            ensure_ascii=False, indent=2)
+          print(text)
+          with open(os.environ["GITHUB_STEP_SUMMARY"], "a", encoding="utf-8") as fh:
+              fh.write("## Binance notify bot identity\n\n```json\n" + text + "\n```\n")
+          PY

.github/workflows/refresh-binance-account-facts.yml

@@ -0,0 +1,90 @@
+name: Refresh Binance Account Facts
+
+"on":
+  schedule:
+    - cron: "17 6 * * *"
+  workflow_dispatch:
+    inputs:
+      enabled:
+        description: "Run one read-only account-facts refresh; the repository gate must also be enabled."
+        required: true
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch-account-facts-read:
+    if: >-
+      github.repository == 'QuantStrategyLab/BinancePlatform' &&
+      github.ref == 'refs/heads/main' &&
+      vars.BINANCE_ACCOUNT_FACTS_REFRESH_ENABLED == 'true' &&
+      (github.event_name == 'schedule' ||
+       (github.event_name == 'workflow_dispatch' && inputs.enabled == true))
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions:
+      actions: write
+      contents: read
+    steps:
+      - name: Dispatch the fixed read-only account-facts workflow
+        shell: python
+        env:
+          GITHUB_API_URL: ${{ github.api_url }}
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          import json
+          import os
+          import sys
+          from urllib.error import HTTPError, URLError
+          from urllib.request import HTTPRedirectHandler, Request, build_opener
+
+          api_url = os.environ.get("GITHUB_API_URL", "").rstrip("/")
+          token = os.environ.get("GITHUB_TOKEN", "")
+          if not api_url or not token:
+              print("account_facts_dispatch_not_configured", file=sys.stderr)
+              raise SystemExit(1)
+
+          url = (
+              f"{api_url}/repos/QuantStrategyLab/BinancePlatform/actions/"
+              "workflows/binance-account-facts.yml/dispatches"
+          )
+          payload = {
+              "ref": "runtime-production",
+              "inputs": {"enabled": True, "source_mode": "direct_read"},
+          }
+          request = Request(
+              url,
+              data=json.dumps(payload).encode("utf-8"),
+              headers={
+                  "Accept": "application/vnd.github+json",
+                  "Authorization": f"Bearer {token}",
+                  "Content-Type": "application/json",
+                  "X-GitHub-Api-Version": "2022-11-28",
+              },
+              method="POST",
+          )
+
+          class RejectRedirects(HTTPRedirectHandler):
+              def redirect_request(self, _request, _file, _code, _message, _headers, _url):
+                  return None
+
+          opener = build_opener(RejectRedirects)
+
+          try:
+              with opener.open(request, timeout=30) as response:
+                  if response.status not in (200, 204):
+                      print("account_facts_dispatch_outcome_unknown", file=sys.stderr)
+                      raise SystemExit(1)
+          except HTTPError as error:
+              if 400 <= error.code < 500:
+                  print("account_facts_dispatch_rejected", file=sys.stderr)
+              else:
+                  print("account_facts_dispatch_outcome_unknown", file=sys.stderr)
+              raise SystemExit(1)
+          except (URLError, TimeoutError, OSError):
+              print("account_facts_dispatch_outcome_unknown", file=sys.stderr)
+              raise SystemExit(1)
+
+          print("account_facts_dispatch=accepted")

.github/workflows/runner-scheduler-diagnostics.yml

@@ -11,91 +11,15 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  inspect:
+  observe:
+    if: ${{ github.ref == 'refs/heads/main' }}
     runs-on: self-hosted
-    timeout-minutes: 10
+    timeout-minutes: 3
     steps:
-      - name: Inspect scheduler configuration
-        shell: bash
-        run: |
-          set -euo pipefail
+      - name: Checkout reviewed main source
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
 
-          redact() {
-            sed -E \
-              -e 's/github_pat_[A-Za-z0-9_]+/[REDACTED_GITHUB_TOKEN]/g' \
-              -e 's/gh[pousr]_[A-Za-z0-9_]+/[REDACTED_GITHUB_TOKEN]/g' \
-              -e 's/(Authorization:[[:space:]]*Bearer[[:space:]]+)[A-Za-z0-9_.-]+/\1[REDACTED]/g' \
-              -e 's/(x-access-token:)[^@[:space:]]+/\1[REDACTED]/g' \
-              -e 's/((TOKEN|SECRET|KEY|PASSWORD)[A-Z0-9_]*[[:space:]]*=[[:space:]]*)[^[:space:]]+/\1[REDACTED]/g'
-          }
-
-          section() {
-            printf '\n===== %s =====\n' "$1"
-          }
-
-          section "host"
-          {
-            date -u
-            hostname
-            id
-            pwd
-            uname -a
-          } | redact
-
-          section "ubuntu crontab"
-          crontab -l 2>&1 | redact || true
-
-          section "root crontab"
-          sudo -n crontab -l 2>&1 | redact || true
-
-          section "systemd timers"
-          systemctl list-timers --all 2>&1 | redact || true
-
-          section "matching systemd units"
-          systemctl list-units --all 2>&1 | grep -Ei 'binance|quant|github|dispatch|runtime' | redact || true
-
-          section "cron and systemd files"
-          find /etc/cron.d /etc/cron.hourly /etc/cron.daily /etc/systemd/system -maxdepth 2 -type f -print 2>/dev/null \
-            | sort \
-            | grep -Ei 'binance|quant|github|dispatch|runtime|cron|timer|service' \
-            | redact || true
-
-          section "candidate dispatch files"
-          find /home/ubuntu /usr/local/bin /opt -maxdepth 6 \
-            \( -path '*/.git' -o -path '*/_work' -o -path '*/node_modules' \) -prune -o \
-            -type f \
-            \( -name '*.sh' -o -name '*.py' -o -name '*.service' -o -name '*.timer' -o -name '*.env' -o -name 'crontab' \) \
-            -print 2>/dev/null \
-            | sort \
-            | grep -Ei 'binance|quant|github|dispatch|runtime|cron' \
-            | redact || true
-
-          section "dispatch content matches"
-          find /home/ubuntu /usr/local/bin /opt /etc/cron.d /etc/systemd/system -maxdepth 8 \
-            \( -path '*/.git' -o -path '*/_work' -o -path '*/node_modules' \) -prune -o \
-            -type f \
-            \( -name '*.sh' -o -name '*.py' -o -name '*.service' -o -name '*.timer' -o -name '*.env' -o -name '*.conf' -o -name 'crontab' \) \
-            -print 2>/dev/null \
-            | while IFS= read -r file; do
-                if grep -IlE 'actions/workflows/main\.yml/dispatches|workflow_dispatch|QuantStrategyLab/BinancePlatform|binance-quant|binancequant' "$file" >/dev/null 2>&1; then
-                  printf '%s\n' "$file"
-                fi
-              done \
-            | sort \
-            | head -200 \
-            | redact || true
-
-          section "dispatch script redacted"
-          if [ -f /home/ubuntu/binance-quant/ops/dispatch-runtime.sh ]; then
-            sed -n '1,240p' /home/ubuntu/binance-quant/ops/dispatch-runtime.sh | redact
-          else
-            echo "dispatch-runtime.sh not found"
-          fi
-
-          section "dispatch env keys"
-          if [ -f /home/ubuntu/.config/binance-platform/dispatch.env ]; then
-            sed -E 's/(^[[:space:]]*(export[[:space:]]+)?[A-Za-z_][A-Za-z0-9_]*=).*/\1[REDACTED]/' \
-              /home/ubuntu/.config/binance-platform/dispatch.env | redact
-          else
-            echo "dispatch.env not found"
-          fi
+      - name: Observe scheduler state
+        run: python3 -m scripts.runtime_scheduler_probe

.github/workflows/runtime-heartbeat.yml

@@ -34,6 +34,7 @@ jobs:
     env:
       RUNTIME_HEARTBEAT_NAME: BinancePlatform Runtime
       RUNTIME_HEARTBEAT_WORKFLOW: main.yml
+      RUNTIME_HEARTBEAT_BRANCH: ${{ vars.RUNTIME_HEARTBEAT_BRANCH || 'runtime-production' }}
       RUNTIME_HEARTBEAT_LOOKBACK_HOURS: ${{ inputs.lookback_hours || vars.RUNTIME_HEARTBEAT_LOOKBACK_HOURS || '2.5' }}
       RUNTIME_HEARTBEAT_EXPECTED_INTERVAL_HOURS: ${{ vars.RUNTIME_HEARTBEAT_EXPECTED_INTERVAL_HOURS || '1' }}
       RUNTIME_HEARTBEAT_MAX_CONSECUTIVE_MISSES: ${{ vars.RUNTIME_HEARTBEAT_MAX_CONSECUTIVE_MISSES || '2' }}